WebAuthn enrollment UI and account binding

Problem/Motivation

Native WebAuthn (verify_at: webauthn) only works after a credential is registered for a user handle. 1.3.0 ships JSON APIs only:

• POST /api/file-gate/webauthn/register/options
• POST /api/file-gate/webauthn/register
• list / delete

There is no Drupal UI for a normal user or admin to "Add security key" on an account. Mint subject / grant sh= / query wh= must also be documented and wired so registration handle matches assertion handle.

OIDC / edge-mTLS modes enroll keys at the IdP or proxy — out of scope here. This issue is native RP enrollment.

GitHub: Wilkes-Liberty/file_gate#38 (implementation work happens there; this issue is the public dual-venue record).

Proposed resolution

1. User-facing enrollment (permission Register File Gate WebAuthn credentials): account page or dedicated route to register / list / remove keys (browser WebAuthn ceremony).
2. Admin path (optional): manage credentials for a handle/subject without that user performing registration (B2B / break-glass).
3. Binding docs: how mint subject maps to user_handle and grant sh=; examples for uid-based and subject-based handles.
4. Fail-closed UX: clear empty-state when no credentials exist for the grant handle.

Remaining tasks

• UI registration ceremony works for authenticated users
• List + remove own credentials
• Docs in docs/assurance-redeem.md + README
• Kernel or functional tests for storage + permission gates (full browser E2E stays on the manual E2E issue)
• Dual-venue status updated on ship

User interface changes

New account (and optional admin) WebAuthn credential management screens under file_gate_assurance.

API changes

None required beyond existing registration JSON APIs; UI consumes them.

Data model changes

None if existing credential storage is sufficient.